300-word summary
DPDP is India's personal data protection law. For verification workflows, the practical idea is simple: if you collect or process personal data, explain the purpose, collect only what is needed, protect it, allow rights requests, and avoid using the data for unrelated reasons.
Consent matters because verification can affect real people: workers, candidates, residents, visitors, vendors, and households. A good product shows the person what is being requested before checks run. It keeps a record of consent, limits access to the result, and provides a route for correction, erasure, grievance, or other rights requests where applicable.
DPDP is more than a banner or checkbox. The hard part is operational: retention, audit logs, breach workflows, staff access, vendor contracts, and human support. PRAMAAN is designed around those product requirements, while this article remains general information rather than legal advice.
Consent and purpose limitation
- State the purpose before collecting data.
- Ask for consent where the workflow requires it.
- Run only the selected checks.
- Use the data only for the stated purpose.
- Provide a rights and grievance path.
What businesses must build
- Consent capture with purpose text.
- Retention and deletion controls.
- Access, correction, erasure, and grievance workflows.
- Audit logs for who accessed what and why.
- Vendor and processor review for sensitive workflows.
Useful PRAMAAN links
Read the privacy notice, use data subject rights, contact the grievance officer, and review how consent works.